Danalock V3 Smart Lock nRF DFU firmware rewrite twice

RE: Danalock V3 Smart Lock nRF DFU firmware rewrite twice

Vidar Berg — Fri, 23 Sep 2022 05:30:32 GMT

In general, the only way you will be able to overwrite the bootloader is if the vendor distributes a new bootloader with a higher version number. This is to prevent replay attacks which can wear out flash or cause denial of service.

If you suspect that the bootloader has been tampered with somehow, you probably can't trust it to perform the update either.

RE: Danalock V3 Smart Lock nRF DFU firmware rewrite twice

lenovomen — Thu, 22 Sep 2022 16:23:01 GMT

There must be some way to overwrite the firmware repeatedly. 🤔

RE: Danalock V3 Smart Lock nRF DFU firmware rewrite twice

lenovomen — Thu, 22 Sep 2022 16:11:29 GMT

The answer is simple. It only allows you to run a full upgrade on the first upgrade. The second one will not run. If the Smart lock is replaced, the infected bootloader cannot be overwritten.

RE: Danalock V3 Smart Lock nRF DFU firmware rewrite twice

Vidar Berg — Thu, 22 Sep 2022 13:08:15 GMT

But how would an adversary be able to upload malicious code in the first if they don't have access to the private key needed to sign the update? Also, please keep in mind that the vendor is free to add additional security mechanisms into their design. I can only really comment the security we have implemented in our code examples.

RE: Danalock V3 Smart Lock nRF DFU firmware rewrite twice

lenovomen — Tue, 20 Sep 2022 18:15:10 GMT

So now I don't know what the solution is. The description says that when the bootloader is uploaded, the whole firmware file is not scanned, so malicious code can be uploaded.

RE: Danalock V3 Smart Lock nRF DFU firmware rewrite twice

lenovomen — Tue, 20 Sep 2022 18:04:57 GMT

But technically, is it possible that malicious code is placed in the bootloader to make the bluetooth connection crackable?

RE: Danalock V3 Smart Lock nRF DFU firmware rewrite twice

Vidar Berg — Tue, 20 Sep 2022 18:03:39 GMT

This is the reason for why the bootloader will only accept signed updates. The bootloader also includes the option for Boot validation.

RE: Danalock V3 Smart Lock nRF DFU firmware rewrite twice

lenovomen — Tue, 20 Sep 2022 16:59:41 GMT

UPDATING: Part 2 of 2 100%

This update has only been fully run once. If I try it now, it runs 1/2 instead of 2/2. And as I wrote above it is risky because it might someone have infected the bootloader, which I cannot overwrite now.

RE: Danalock V3 Smart Lock nRF DFU firmware rewrite twice

lenovomen — Tue, 20 Sep 2022 16:55:12 GMT

The SoftDevice part itself is not enough to reinstall, I suppose that if deep malicious code has been installed, it is the bluetooth connection itself that is vulnerable, not the encrypted (172kb application without bootloader) frimware I installed.

RE: Danalock V3 Smart Lock nRF DFU firmware rewrite twice

lenovomen — Tue, 20 Sep 2022 16:53:04 GMT

I had a hunch that was the reason. But what if someone replaced my smart lock and installed an hacked firmware/bootloader? I cannot overwrite the hacked version because the system detects that the latest version is installed. There must be some way to overwrite the bootloader again.

RE: Danalock V3 Smart Lock nRF DFU firmware rewrite twice

Vidar Berg — Tue, 20 Sep 2022 06:59:56 GMT

nrftoolbox will proceed right to the application update if the softdevice and bootloader are up-to-date. In other words, it seems like you already have the latest version of the bootloader and softdevice in your device.

RE: Danalock V3 Smart Lock nRF DFU firmware rewrite twice

lenovomen — Mon, 19 Sep 2022 17:41:08 GMT

I use Nrf toolbox. Apparently successful but in fact the first process does not run it skips.

RE: Danalock V3 Smart Lock nRF DFU firmware rewrite twice

Vidar Berg — Mon, 05 Sep 2022 13:04:01 GMT

Hello,

[quote user=""]UPDATING: Part 2 of 2 100% [/quote]

I'm not sure what app you use to perform the update, but the message indicates to me that the device was updated successfully. How do you determine that the bootloader did not get updated?

Thanks,

Vidar